Monday, April 27, 2009

"One uploaded photo, credit card number or status update at a time, we are relinquishing our privacy and anonymity." That's according to the results of a study on how society's use of information communication technologies impacts privacy and anonymity. University of Ottawa professor Ian Kerr and nearly two dozen researchers from across the globe spent four years examining the issue, ultimately determining that our anonymity and right to privacy is in jeopardy.

The results of their research have been published in a book, On the Identity Trail: Anonymity, Privacy and Identity in a Networked Society, which is available for free download online. Kerr also provides an overview in this CBC podcast, which aired on April 17, 2009.

The researchers reported that governments are choosing laws that require people to identify themselves and are lowering judicial thresholds defining when identity information must be disclosed to law enforcement officials. That is allowing the wider use of new technologies capable of making people identifiable, including smartcards, security cameras, GPS, tracking cookies and DNA sequencing.

Consequently, governments and corporations are able to do things like:

Embrace technologies such as radio frequency identification tags that can be used to track people and merchandise to analyze behaviour.

Boost video surveillance in public places.

Pressure companies such as internet service providers to collect and maintain records of identification information about their customers.

While Canada, the U.K., the Netherlands and Italy all have national laws protecting privacy – that is, laws that allow citizens to control access to their personal data – such legal protection does not exist for anonymity.

Wednesday, March 11, 2009

This week's CBC "Search Engine" podcast explores the use of RFID technology in Canadian driver's licenses. Ontario Privacy Commissioner Ann Cavoukian shares her privacy concerns about enhanced drivers' licenses (EDLs) and discusses ways citizens who choose to use EDLs could protect their personal information from RFID skimmers when the cards are not in use. She emphasizes that use of EDLs is voluntary and expects on-off switch technology for the IDs to be ready in 2010.

Enhanced driver's licenses have been developed as a passport alternative for use when crossing the U.S. border. They are already in use in Manitoba and are set to launch in Ontario this June.

Thursday, March 5, 2009

Rob Spence, a Canadian filmmaker who lost an eye in an accident as a teenager, plans to have a mini camera installed in his prosthetic eye to make documentaries and raise awareness about surveillance in society.

For Project Eyeborg, Spence will have a camera, a battery and a wireless transmitter mounted on a tiny circuit board in his prosthetic eye, but no part of the camera would be connected to his nerves or his brain.

"In Toronto there are 12,000 cameras. But the strange thing I discovered was that people don't care about the surveillance cameras, they were more concerned about me and my secret camera eye because they feel that is a worse invasion of their privacy."

Spence, whose last film "Let's All Hate Toronto" explored the Canada-wide trend of hating that city, has no plans to make reality programming. The focus of his latest film is surveillance and the eye project has become central to the film.

Thursday, February 12, 2009

While the Vancouver 2010 Olympics have come under criticism for rapidly inflating costs, federal privacy commissioner Jennifer Stoddart is sounding the alarm about security plans for the winter event.

“Experience has shown that Olympic Games and other mega-events can leave a troubling legacy – large-scale, security surveillance systems installed for mega-events often remain long after the event is over,” she says. What happened following the Athens Games of 2004 is a case in point. Closed-circuit cameras installed for the Games were left in place afterwards to help law enforcement monitor citizens, notably during public demonstrations.

British Columbia’s privacy commissioner, David Loukadelis said last year that he had been assured by the RCMP the images from those cameras will be available only to key people. While using extraordinary measures to keep diplomats and athletes safe is reasonable for a special event he is concerned that once the Games are over, those cameras might remain and become a unreasonable infringement on everyday privacy rights.

Just as in Athens, following the Olympics in Sydney, many closed-circuit TV cameras were left in place after the Games.

Both Stoddart and Loukadelis have discussed security and privacy issues for the Games and will collaborate in monitoring security measures and privacy protections, in order to ensure that privacy rights are fully respected during the Games and after.

Friday, January 30, 2009

The PEW Internet and American Life project released a report this week on Generations Online in 2009. The study shows that while over half of the adult internet population is between 18 and 44 years old, larger percentages of older generations are online now than in the past, and they are doing more activities online, according to surveys taken from 2006-2008.

Contrary to the image of Generation Y (born between 1977-1990) as the "Net Generation," internet users in their 20s do not dominate every aspect of online life.

Among the key findings:

Generation X (born 1965-1976), is the most likely group to bank, shop, and look for health information online.

Boomers (born 1946 - 1964) are just as likely as Generation Y to make travel reservations online.

Silent Generation internet users (born 1937-1945) are competitive when it comes to email (although teens might point out that this is proof that email is for old people).

The most dramatic increase in internet use can be seen in the 70-75 year-old age group. While just over one-fourth (26%) of 70-75 year olds were online in 2005, 45% of that age group is currently online.

Tuesday, January 27, 2009

January 28th marks the 2nd annual international data privacy day in Canada, the U.S. and 27 European countries. The purpose of the event is to "raise awareness and generate discussion about data privacy practices and rights." It also serves the important purpose of furthering international collaboration and cooperation around privacy issues.

This year's data privacy day comes on the heels of what may have been the largest breach ever reported, with the personal information of nearly 100 million exposed at a U.S.-based credit card processing firm. Hackers breached the computer network at Heartland Payment Systems Inc., exposing customers' credit card numbers, card expiration dates and some internal bank codes - all information that could be used to forge a credit card. The company handles 100 million card transactions for 250,000 businesses nationwide each month.

The scale of the breach is “shocking,” says Jennifer Stoddart, Privacy Commissioner of Canada.

“After what we saw at TJX, that you could have such a major data breach, I'm asking myself what is happening and what is not getting through to organizations?” she says. “You should always take the steps to make sure there is suitable protection.”

As this most recent breach demonstrates, there is still much work to be done to raise awareness about data privacy.

Saturday, November 8, 2008

British Columbia’s provincial government is planning to spend one million dollars on a pilot CCTV project to help combat crime in Vancouver, Kelowna and Surrey.

According to the province’s Solicitor General, John van Dongen:

Technologies such as CCTV can greatly assist the police and the prosecution in bringing offenders to justice. We believe CCTV can be an important tool in catching criminals and improving public safety.

If we look at the results of CCTV use in the U.K., van Dongen is vastly over-stating its effectiveness. The U.K. began experimenting with CCTV in the 1970’s and its use has grown to more than 4 million cameras across the UK, or at least one for every 14 people. In 2002, it was estimated that the average London resident was captured on camera about 300 times per day. Since the mid-1990’s billions of pounds have been spent on CCTV technology in the UK.

Yet, despite all this, a recent report from New Scotland Yard indicated that only about 3% of crimes were solved by the use of CCTV. Furthermore, a report by the Home Office in 2002, which reviewed 18 other studies on the effectiveness of CCTV, found just a 4% overall reduction in crime when CCTV cameras were used.

Given these results, the evidence tells us that the return on investment with CCTV is far too low to warrant the expense. One study indicates that there would have been a greater reduction in crime if those billions of pounds had been spent on more cops walking the beat. Jonathan Klick, a law professor at Florida State University, and Alexander Tabarrok of George Mason University, studied the increased police presence in key areas of Washington D.C. during high terror alert days and found a 15 percent reduction in crime.

The added and less quantifiable cost of CCTV is the loss of privacy to citizens and the negative impact on civil liberties.B.C.’s Solicitor General said he intended to work with the province’s Information and Privacy Commissioner “to establish clear rules for the collection, management and protection of information from the cameras.” However, Privacy Commissioner David Loukidelis said he learned about the program a mere fifteen minutes before the news conference announcing the CCTV pilot project.

BC residents and politicians who are concerned about crime and public safety should advocate for more police officers, community policing programs and proven crime prevention measures (such as improved lighting) instead of throwing away millions in tax dollars in the creation of a surveillance society.

Saturday, October 25, 2008

A manager at a railway company uses the zoom lens on cameras, installed for the purpose of monitoring train movements, to watch two employees leaving company property during regular working hours without permission.

An employee with a history of work-related injuries over a period of several years refuses to cooperate with his employer’s efforts to accommodate him or to provide current information to support his disability claim. His employer hires a private investigation firm to conduct covert video surveillance to observe the employee for a period of two weeks to determine if he indeed had the physical limitations he was claiming.

A transportation company hires a private investigation firm to conduct surveillance on an employee suspected of violating the company’s Conflict of Interest Policy by having a romantic relationship with a colleague. While the employee under investigation was the target of the surveillance, images were also covertly captured of the colleague and alleged romantic partner.

Which of the above scenarios are in violation of PIPEDA (Personal Information Protection and Electronic Documents Act)? *

The Privacy Commissioner of Canada has prepared a draft guidance document that sets out good practice rules for private sector organizations that are either contemplating or using covert video surveillance.

The guidelines also include the test used by the Office of the Privacy Commissioner to determine whether an organization may properly rely on covert video surveillance:

1. The collection of personal information must only be for purposes that a reasonable person would consider appropriate in the circumstances.

2. There should be substantial evidence to support the suspicion that:

the relationship of trust between the organization and an individual has been broken;

there has been a breach of an agreement; or,

a law has been contravened.

3. Covert surveillance is a last resort and should only be contemplated if all other less privacy-invasive means of collecting personal information have been exhausted.

4. The collection of personal information must be limited to the stated purposes to the greatest extent possible.

Feedback on the draft guidance will be received until November 14, 2008. The Privacy Commissioner is particularly interested in comments from those directly affected by covert video surveillance, including unions representing employees of federally regulated organizations as well as consumer associations.

*Only the scenario in the first bullet was found to be in violation of PIPEDA.